@doist/reactist
Open source React components by Doist
15
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
ricardoisthenningmujvalenteantondoistjefcurtisdmgaweldoistbotfbidugoncalossilvaomar.doist.comscottatdoisternestodoist
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Org-managed package published via CI; maintainer rotation is expected and covered by SLSA provenance. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Named maintainers are known Doist org members; consistent with org-managed package published via GitHub Actions CI. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): patch-package postinstall is a standard dependency-patching pattern; stable for this package. | ai | |
| phantom-deps | phantom-dep:patch-package | AI (phantom-deps): patch-package is invoked via postinstall script, not imported; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:react-markdown | AI (phantom-deps): react-markdown is a runtime dep used in components; phantom-dep heuristic misfires on this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Doist OSS library; README signals are false positives for this well-known package. | ai |